• 0 Posts
  • 29 Comments
Joined 9 months ago
cake
Cake day: December 26th, 2023

help-circle
  • The actual difference between a working new mouse and a failing double click mouse is in the button itself (mechanical parts are almost always the problem).

    However, it is not some exotic failure mode. All mechanical switches have a “bounce”, where the contact makes and breaks a few times before settling into the connected position. Switches are typically designed to make the actual contact spring loaded (which is the origin of the click sound you here). As they age, this mechanism degrades, making the bouncing problem worse.

    However, this is a well understood problem that any electrical engineer should be familiar with. One solution is to install a filter capacitor. Now it takes longer to switch between the on and off state, so the inherent bounce in the switch is smoothed out to the point where you cannot detect it.

    They probably did testing with a new switch, and decided that they didn’t need to include any explicit debounce component, ignoring the fact that the switch would degrade over its lifetime.




  • In addition to the raw compute power, the HP laptop comrmes with a:

    • monitor
    • keyboard/trackpad
    • charger
    • windows 11
    • active cooling system
    • enclosure

    I’ve been looking for a lapdock [0], and the absolute low-end of the market goes for over $200, which is already more expensive than the hp laptop despite spending no money on any actual compute components.

    Granted, this is because lapdocks are a fairly niche product that are almost always either a luxury purchase (individual users) or a rounding error (datacenter users)

    [0] Keyboard/monitor combo in a laptop form factor, but without a built in computer. It is intended to be used as an interface to an external computer (typically a smartphone or rackmounted server).



  • At a $188 price point. An addition 4GB of memory would probably add ~$10 to the cost, which is over a 5% increase. However, that is not the only component they cheaped out on. The linked unit also only has 64GB of storage, which they should probably increase to have a usable system …

    And soon you find that you just reinvented a mid-market device instead of the low-market device you were trying to sell.

    4GB of ram is still plenty to have a functioning computer. It will not be as capable of a more powerful computer, but that comes with the territory of buying the low cost version of a product.




  • I’m one of those security specialists (although not on mastodon). To be clear, if a vulnerable version of libxz were included in a distribution that we actually use; this would be an all hands on deck, drop everything until it is fixed emergency.

    Having said that, for an average user, it probably doesn’t matter. First, many users just don’t have the vulnerable version installed. All things considered, it was found very quickly; so only rolling release distros would have it. Additionally, it appears that only .deb or .rpm based distributions would have it. Not because they are particularly vulnerable, the attack explicitly tests for it.

    However, lets set all of this asside and assume a typical use is running a vulnerable system. In my assessment, the risk to them is still quite low. With most vulnerabilities, the hard part is discovering it. Once that happens, the barrier to exploiting it is relatively low, so you get a bunch of unrelated hackers trying to exploit any system they can find. This case is different; exploiting it requires the attackers private key. Even though the attack is now widely known, there is still only 1 organization capable of using it.

    Further, this attack was sophisticated. I’m not going to go as far as others in saying that only a state actor could do it. However, it is hard to think of anyone other than a state actor who would do it. Maybe a group of college kids doing it for the lolz research? But, if the motivation us lolz, I don’t see them pivoting to do anything damaging with it. And even if they wanted to, there would still only be a handful of them. In short, this is one of those cases where obscurity works. Whoever did this attack does not know or care about Joe the Linux user; and they were probably never going to risk burning it by exploiting it on a large scale.

    However, setting all of that asside, suppose you were using vulnerable software, and someone with the private key is interested in your home system. First, you would need to be running OpenSSH on a remotely accessible interface. [0]. Second, you would need your firewall to allow remote SSH traffic. Third, you would need your router to have port forwarding enabled; and explicitly configured to forward traffic to your OpenSSH server [1].

    If all of that happens; then yes, you would be at risk.

    [0] Even though the attack itself is in the libxz library, it appears to specifically target OpenSSH.

    [1] Or, the attacker would need some other mechanism to get on the same network as you.



  • Out of all the sovereign citizen nonsense I have seen, this is probably the most likely to work. Not in a “that is the way the law works” kind of way, but in the “the other party might actualy get duped” way.

    Essentially, it is a variant of the fake invoice scam. In a fake invoice scam, you send a bill to a company you never worked for. Normally, the company will look at it and ask “what is this about?”. However, occasionally the bill will land on top of a pile of paperwork. Then a parent who was up all night with a sick kid will come in in the morning, see an unpaid bill, and write the check before having their morning coffee.

    Essentially the same thing happened here. The bank got paperwork from the IRS saying that the bank forgave the loan (point 1 to the scammer for having this come through the IRS). Of course, most of the time, the banks response is going to be “no we didn’t”, at which point the scammer looses. But occasionally an employee at the bank is going to mess up, and do something that might result in the loan actually being forgiven.



  • I’d just like to interject for a moment. What you’re referring to as Linux, is in fact, GNU/Linux, or as I’ve recently taken to calling it, GNU plus Linux. Linux is not an operating system unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS as defined by POSIX.

    Many computer users run a modified version of the GNU system every day, without realizing it. Through a peculiar turn of events, the version of GNU which is widely used today is often called “Linux”, and many of its users are not aware that it is basically the GNU system, developed by the GNU Project.

    There really is a Linux, and these people are using it, but it is just a part of the system they use. Linux is the kernel: the program in the system that allocates the machine’s resources to the other programs that you run. The kernel is an essential part of an operating system, but useless by itself; it can only function in the context of a complete operating system. Linux is normally used in combination with the GNU operating system: the whole system is basically GNU with Linux added, or GNU/Linux. All the so-called “Linux” distributions are really distributions of GNU/Linux.


  • who will balance Israel’s right to self defence against the horrors we’re all looking at

    I really hate this framing. Israel’s response has not been in Israel’s self interest. There is approximately 0% chance they will defeat Hamas, and approximately 100% chance they have hardended militant anti-Israel sentiment among Gazans for a generation. Further, they have alienated all of their potential regional allies (just as relations were starting to normalize), which is terrible for their long term security prospects in general; and their ability to resolve the Gaza problem in particular (since an ally that Gazan’s can trust would be incredibly useful).

    Further, Hamas is not Israel’s biggest threat by far. They spent years planning an attack that only succeeded because of a massive failure on the part of the IDF; and only lasted for a day before the IDF completely steamrolled them.

    As we can see know (and has been obvious from the beginning), Hezbolla in Lebanon is much greater military threat. Prior to the war, they were constrained by their rational self interest of avoiding a full war with Israel. In the beginning of the war, they made some pro-forma attacks, to which Israel offered some pro-forma responses; but things along the Israel Lebanon border were relatively quiet, because neither sude really wanted a war. However, as Israel continued its operation in Gaza, the political pressures in Lebanon grew, forcing an escallation of the conflict their. At this point, excluding the initial attack most of the damage to Israel has come not from Gaza, but Lebanon; and the IDF cannot just steamroll them.

    And Israel is still in the “good case” of escalation. The elephant in the room here is Iran. As far as I can tell, Iran is not happy about this level of conflict, and is actively trying to avoid getting drawn in. However, it cannot simply abandon its proxies without massive loss of regional power. Nor can it be seen to abandon Gaza without significant internal political problems. The longer this war goes on, the greater the risk of Iran being fully dragged into it. If that happens, then everything up to this point will look like childs play. Israel will probably survive, but for the first time in decades, that will be brought into question.

    None of this is new. This is the exact dynamic that was in play on October 6, when Israel’s actions were fully consistent with being aware of this dynamic. When October 7th happened, it did give Israel a bit more leeway to operate in Gaza; but that has always been limited, and has been long exhausted. Now, the dynamics are effectively the same as on October 6, but Israel is making the other decision of actively poking the bear of a regional war insted of simply tiptoeing around it as they had been doing. And Israel’s security suffers greatly for it.





  • The biggest reform I want to see to copyright is a use-it-or-loose-it provision. Either you make the work available under “reasonable” terms, or you loose the copyright protection. Preferably this should be combined with a requirement of all copyrighted works past a certain size to be registered with the library of Congress.

    This would still allow them to double the price, and move streaming from Netflix to their crappy homebrew streaming service. The idea is just that if you aren’t selling it at all, you clearly don’t need copyright protections to save you from others undercutting you. This would also solve the abandonware problem; where it is simply not clear who has the rights in the first place.

    My second wish would be a mandatory licensing scheme; similar to what we have for music (although updated for the internet age)